Privacy Policy and KVKK Disclosure Notice

DOBA GROUP MEDİKAL SANAYİ VE TİCARET A.Ş. ("VORELL", the "Company" or "we"), acting as data controller under the Personal Data Protection Law No. 6698 ("KVKK"), processes the personal data it obtains through the vorell.co website (the "Site") within the framework of this Privacy Policy and Disclosure Notice. We attach great importance to the confidentiality and security of your personal data.

This text explains which of your personal data we process and for which purposes, with whom we share it, how long we retain it, and your rights under the KVKK.

1. Identity of the Data Controller

Pursuant to the KVKK, your personal data is processed by the Company whose details are set out below, in its capacity as data controller:

• Trade Name: DOBA GROUP MEDİKAL SANAYİ VE TİCARET A.Ş.
• Brand: VORELL
• Address: Hürriyet Mah. Dr. Cemil Bengü Cad. No:35/C İç Kapı:1, 34403 Kağıthane / İstanbul, Türkiye
• Phone: +90 538 775 58 88
• Email: hello@vorell.co
• Website: vorell.co
• MERSİS No. (Central Registry Record System): 0302144363500001
• Tax Office / Tax No.: Kâğıthane / 3021443635
• KEP Address (Registered Electronic Mail): Our KEP application has been filed; the KEP address to be assigned to us when the account is opened will be published in this field.

2. Personal Data Processed

Depending on the nature of the services we provide through the Site, your personal data may be processed in the following categories:

• Identity Data: First name, last name.
• Contact Data: Email address, telephone number, delivery and billing address.
• Customer Transaction Data: Order number, order contents, cart and purchase history, request and complaint records, return/exchange records.
• Financial Data: Invoice details, payment method and payment confirmation details. (Your credit/debit card details are not stored by us; payment transactions are carried out through licensed payment institutions.)
• Transaction Security Data: IP address, cookie records, session data, device and browser data, log records.
• Marketing Data: Newsletter/campaign preferences, analysis results relating to shopping habits and preferences, communication permissions based on explicit consent.

3. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

• Receiving, preparing, shipping and delivering your orders,
• Concluding and performing the sales agreement, issuing invoices and keeping statutory accounting records,
• Carrying out and verifying payment transactions,
• Conducting the processes relating to your return, exchange, cancellation and withdrawal rights,
• Providing customer support services and managing your requests and complaints,
• Creating a membership and managing your account,
• Sending commercial electronic messages (campaigns, discounts, newsletters) and carrying out marketing activities, where your explicit consent exists,
• Ensuring the security of the Site and of transactions, and preventing fraud,
• Improving our products and services and carrying out analysis and statistical studies,
• Fulfilling the obligations arising from the relevant legislation and providing information to the competent authorities.

4. Legal Grounds for Processing Personal Data

Your personal data is processed on the following legal grounds within the scope of Articles 5 and 6 of the KVKK:

• Being directly related to the conclusion or performance of a contract (Art. 5/2-c): Order and delivery processes, payment, return and exchange transactions.
• Fulfillment of a legal obligation (Art. 5/2-ç): Issuance of invoices and the retention obligations under tax and commercial legislation.
• Processing being mandatory for the establishment, exercise or protection of a right (Art. 5/2-e): Management of dispute and claim processes.
• Legitimate interest of the data controller (Art. 5/2-f): Site and transaction security, improvement of service quality, prevention of fraud.
• Explicit consent (Art. 5/1): Sending commercial electronic messages, profiling for marketing purposes and the use of non-essential cookies.

5. Method of Collecting Personal Data

Your personal data is collected in electronic form by automated and partially automated means, through the membership and order forms on the Site, our communication and support channels, newsletter sign-up fields, cookies and similar technologies.

6. Transfer of Personal Data

In order to achieve the purposes stated above and in accordance with the conditions set out in Articles 8 and 9 of the KVKK, your personal data may be shared, to the extent necessary, with the following groups of recipients:

• Shipping and logistics companies: for the purpose of delivering your orders,
• Payment and financial institutions: for the purpose of executing and verifying payments,
• E-commerce and technology infrastructure providers (e.g. Shopify): for the purpose of operating the Site and the shopping infrastructure,
• Cloud/hosting service providers located in Türkiye and abroad: for the purpose of hosting data securely,
• Email, SMS and marketing service providers: for communication activities based on your explicit consent,
• Financial advisors, legal counsel and audit firms: within the scope of legal obligations and advisory services,
• Competent public institutions and organizations: where they request information pursuant to the relevant legislation.

Since part of our Site infrastructure is provided by service providers hosting servers abroad (e.g. Shopify), your personal data may be transferred abroad in accordance with the conditions set out in the KVKK. Such transfers are carried out with security measures compliant with the relevant legislation and, where necessary, within the scope of your explicit consent.

7. Retention Period of Personal Data

Your personal data is retained for as long as the purpose of processing requires, taking into account the statutory limitation and retention periods set out in the relevant legislation (for example, 10 years for commercial and tax records). Upon expiry of the retention period, your personal data is deleted, destroyed or anonymized. If you withdraw your consent, data processed on the basis of explicit consent is no longer processed for the relevant processing activity.

8. Data Security

In order to prevent the unlawful processing of your personal data and unauthorized access to the data, and to ensure the safekeeping of the data, our Company takes the necessary technical and administrative measures to provide an appropriate level of security within the scope of Article 12 of the KVKK.

9. Your Rights under the KVKK (Art. 11)

Pursuant to Article 11 of the KVKK, as a data subject you have the following rights:

• To learn whether your personal data is being processed,
• To request information if your personal data has been processed,
• To learn the purpose of processing your personal data and whether it is used in accordance with that purpose,
• To know the third parties in Türkiye or abroad to whom your personal data is transferred,
• To request the rectification of your personal data if it has been processed incompletely or inaccurately,
• To request the erasure or destruction of your personal data within the conditions set out in Article 7 of the KVKK,
• To request that the rectification, erasure and destruction operations be notified to the third parties to whom the data has been transferred,
• To object to a result arising to your detriment through the analysis of the processed data exclusively by automated systems,
• To claim compensation for the damage if you suffer damage due to the unlawful processing of your personal data.

10. How to Exercise Your Rights (Application)

You may submit your requests concerning the rights set out above to our Company, together with documents verifying your identity, through the following channels:

• By email: to hello@vorell.co (from the email address registered in our system),
• By KEP: our KEP application is in progress; once the address is published on this page, you will also be able to submit applications bearing a secure electronic signature through this channel,
• In writing: by a wet-signed petition sent to Hürriyet Mah. Dr. Cemil Bengü Cad. No:35/C İç Kapı:1, 34403 Kağıthane / İstanbul, Türkiye.

Depending on the nature of the request, your application is concluded free of charge as soon as possible and within 30 (thirty) days at the latest. However, if the process requires an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged. In the event that your request is rejected, that you find the response inadequate or that no response is provided within the applicable period, your right to lodge a complaint with the Personal Data Protection Board is reserved.

11. Changes

This Privacy Policy and Disclosure Notice may be revised in line with changes in the legislation and updates in our Company's business processes. The current text is always published on the Site and enters into force on the date of its publication.

This is a courtesy translation. In the event of any discrepancy, the Turkish version of this document prevails.